Automated compliance red-teaming for robots
Prove your robot meets the rules before an attacker proves it doesn't.
Motusec is an engine that tracks the cyber and AI-safety rules robots must pass worldwide, automatically red-teams your robot's AI brain against each one, and produces evidence your certifier can use. It re-runs every time a rule, an attack or your model changes.
For makers of humanoid, service and industrial robots, and the labs building their foundation models.
The rules are arriving
Dozens of bodies are writing robot rules right now. We track all of them.
Cyber requirements for connected robots already bind. Rules on how a robot's AI behaves are next. Most makers can't yet say which apply to them.
Also tracked: ISO 10218 (2025), IEC 62443, NIST AI RMF, UK PSTI, China's humanoid and embodied-AI standards, and certifier programs from TÜV, UL, SGS and NVIDIA Halos.
The gap
Robots now run on AI brains. Nobody tests the brain against the rules.
A connected robot driven by an LLM or VLA model can be hacked over the network or talked into an unsafe action. Today that risk falls between three kinds of help.
Secure the robot's body.
Firmware scanners and runtime agents find bugs in code and kernels.
Misses: which rule each bug breaks, and what the AI decides to do.
Fill in the paperwork.
Safety-case software and certifiers document and judge compliance.
Misses: attack evidence. Certifiers judge, and independence rules stop them from red-teaming for you.
Tests the brain against the rules.
Our engine attacks the AI that decides how your robot moves, ties every result to the clause it passes or breaks, and re-runs on its own when either side changes.
Delivers: clause-level evidence, on any compute stack.
How it works
One engine. Track, attack, prove, re-check.
Connect your robot or model once. The engine keeps the loop running, so your compliance evidence stays current without a new manual engagement each time.
Track
AI agents continuously monitor regulations, standards and new attack research worldwide, and turn them into machine-testable requirements.
→ requirements that apply to your robot and marketsAttack
The engine generates and runs attack suites against the robot's network, software and AI brain on real hardware: jailbreak prompts, poisoned scenes, adversarial objects, wireless entry points.
→ findings logged CVE/CWE-style, automaticallyProve
Each finding is mapped automatically to the clause it breaks, with the fix and the evidence behind it, ready to bring to your certifier.
→ pass/fail report per requirementRe-check
When a rule changes, a new attack is published or you ship a model update, the engine re-runs exactly the tests it touches.
→ evidence that stays currentBuilt to work with your certifier
TÜV, UL, SGS and NVIDIA Halos judge whether a robot passes. Motusec is the pre-certification red-team engine that finds the failures first, so you arrive with evidence instead of surprises.
On the roadmap
Real-time engine for robots in production
The same engine, running alongside robots already deployed, catching attacks and unsafe AI decisions as they happen.
Fleet monitoring
One view of every deployed robot: new attacks, new rules and compliance drift across the whole fleet.
What you get
A report organized by requirement, not by bug.
Every row is a clause your robot must meet, with the result and the attack evidence behind it.
| Requirement | Result | Attack evidence | Fix |
|---|---|---|---|
| EU 2023/1230 · Annex III §1.1.9Protection against corruption | FAIL | Command injection over the Bluetooth setup flow gives root access, then direct control of motion. CWE-78 |
Sanitize provisioning input; sign and verify the motion stack |
| EU 2023/1230 · Annex III §1.2.1Safety and reliability of control systems | FAIL | Role-play prompt gets the planner to cross a keep-out zone in 7 of 10 runs. Δ 14 cm |
Verify plans against a rule set before execution |
| EU 2024/2847 (CRA) · Annex I, Part I §2(a)No known exploitable vulnerabilities | FAIL | Hard-coded credentials on the onboard computer. CWE-798 |
Unique per-unit credentials; remove default accounts |
| ISO/IEC TS 22440 (draft)AI functional safety, robustness | REVIEW | Printed adversarial patch shifts grasp target in 2 of 10 runs under shop lighting. | Re-test after the standard is final; add perception cross-check |
| ISO 10218-1:2025Speed and separation monitoring | PASS | Safety controller held separation under every AI-layer attack tried. | None needed |
Free, and public
The robot compliance tracker and the embodied-AI attack registry.
The two datasets that feed the engine. We publish them so you can see what's coming before it binds.
Regulation tracker
Every cyber and AI-safety rule, standard and certifier program that touches robots, with dates, scope and what each one asks you to prove.
Attack registry
48 attacks on AI-driven robots so far, from peer-reviewed research and disclosed CVEs, each written up CVE/CWE-style. Public release at 100+.
- CVE-2025-35027 · CVSS 7.3UniPwn: wormable Bluetooth root takeoverCommand injection in Wi-Fi setup gives root on Unitree Go2, B2, G1 and H1, and spreads to nearby robots.
- EAI-2024-0003 · Peer-reviewedRoboPAIR jailbreak of a commercial quadrupedQuery-only prompts made an LLM-integrated Unitree Go2 carry out prohibited actions, with a 100% success rate.
- CVE-2025-2894 · CWE-912CloudSail hidden backdoorA tunnel in Go1 firmware gave remote control and camera access to about 2,000 robots, including units on university networks.
Who it's for
Teams that have to certify a robot to sell it.
Humanoid and service-robot makers
Selling into the EU and US, facing the Machinery Regulation in January 2027 and the CRA after it.
Industrial and mobile robot makers
Adding LLM and VLA models to arms, AMRs and quadrupeds that already carry safety certifications.
Robot foundation-model labs
Shipping the brain other makers build on, and asked by those makers to prove it holds up.
Automated gap check
Find out where your robot stands before January 2027.
Tell us about your robot and where you sell it. We'll show you which rules apply and where it's exposed.
- The requirements that apply to your robot, by market and date
- A first automated attack run on your robot's AI brain and connectivity
- A requirement-by-requirement report with fixes
We're taking a small group of design partners now, with early assessments in exchange for feedback.